The Twitter account for Newsweek was briefly hacked Tuesday morning by a group calling itself the CyberCaliphate, which claims to be affiliated with the Islamic State group.
Newsweek's Twitter feed, which has about 2.5 million followers, sent out one tweet threatening President Obama and his family. Others claimed to have "confidential" Pentagon documents detailing "warfare in social networks." Some of the documents documents — but were labeled for official use only and did contain personal identifying information for Defense Department personnel.
Newsweek removed the messages within 15 minutes and announced its Twitter account was back in business less than two hours later.
"With Allah's permission, we continue CyberJihad inside Pentagon's computer networks," the group said in its mission statement. "Today we publish confidential documents from the US National Cybersecurity Center."
"I think that the group is trying to convey the impression that they have significantly compromised U.S. IT assets, for whatever psychological impact that may have," said cybersecurity expert Bryan Gorczyk in an email to Military Times. The former FBI agent and manager of digital forensics, network security, electronic discovery and incident response practices at Renaissance Associates said the group is getting "their hands on whatever they can and post it knowing that the average American won't have any understanding of what was posted or where it came from."
The group posted several certificates showing individual of training achievements as well as an organizational of various individuals, and a chart for the Defense Cyber Investigations Training Academy. The Defense Cyber Investigations Training Academy, or DCITA operates under the Defense Department's Cyber Crime Center, providing cyber training to Defense Department civilians, military personnel service members and members of individuals in federal law enforcement agencies.
At first glance, Kevin Knierim, a former FBI agent and founder of Cyopsis — an electronic investigative, forensic, and security consulting firm — says the documents are sensitive for a few reasons.
"While not being classified or anything, it was not out in the public domain and intended to be only disseminated to specific people," Knierim said said in an email to Military Times. "The mere fact that it was obtained via an authorized intrusion adds to that belief."
Knierim said the concept of operations cover sheet on one of the documents "looks to be a draft," so the information tweeted out probably came from internal sources.
The group's first message was directed to first lady Michelle Obama, wishing her a "bloody Valentine's day." "We're watching you, your girls and your husband #CyberCaliphate," it read.
It's not immediately clear whether this incident is linked to last month's attack on the Twitter account for U.S. Central Command, but it does bear similarities. In both cases, the hackers took over the accounts' profile and cover images and published menacing commentary claiming to have infiltrated sensitive military networks.
In one image published Tuesday via Newsweek's Twitter feed, the hackers claim to "support our brothers who are liberating the Islamic Emirate of Afghanistan." That line is followed by a list of 13 names identified as "brave mujahideen." Beside it is a head shot of an unidentified man dressed in a camouflage utility uniform and sporting protective eye wear.
Staff writer Jeff Schogol contributed to this story.
